Late January 2026 to June 3 is about 125 days [1][3][1], and that is the figure worth holding in an episode whose participants say the attacker's clock is speeding up [8]. Ledger Donjon spent that window coordinating with Tropic Square, which makes the TROPIC01 secure element sitting inside Trezor's Safe 7 [1][2], and the coordination paid a dividend the original finding did not contain: the chip vendor itself turned up a second attack path, this one touching PIN-related functions [4]. Two findings for the price of one disclosure.
Exposure during those 125 days was close to nil, because the attack wants the device in hand and a laboratory bench to put it on, with no remote or supply-chain route [5]. Which is where price and value come apart. Priced as a threat, this is worth very little; valued as a precedent, it is what Trezor's chief executive, Matej Zak, calls the model the industry should hold itself to [14].
The only dollar figure anywhere near the story is the roughly $116mn tied to Coldcard wallets in July 2026, which Ledger cites as its illustration of weak entropy meeting stronger attack tools [9][10], and which landed about a month after the Trezor disclosure went public, at a different vendor [2]. The material does not say an AI tool was used in it [4]. So the compression argument [8] rests, on this evidence, on an assertion by two firms with a shared interest in industry-wide reporting standards [15], carried by analogy rather than measurement.
What Ledger bought with Donjon's time is worth naming: hours spent on a competitor's silicon are hours not spent on its own secure elements, which are proprietary, unlike Tropic Square's openly designed part [13]. The return is not a sale. It is a reporting norm that would route other people's findings through vendors first, plus a line that Ledger's lab found this before anyone else did, while Trezor gets to say two of its three independent layers were never in play [6][3]. Both readings hold at once, and the record supports the sincere one at least in part, since cross-company disclosures between these two go back to 2018-2019 [11] and a voltage-glitch finding followed the same protocol in 2025 [12].
The reported loss column for this flaw is empty [7][5], which is the strongest thing either company can say and also the reason the standards pitch is hard to price: a process that works leaves no invoice. On the evidence supplied, the push is real engineering with a press release stapled to it, and the test is a count of signatures. A written framework with a named coordination window and a third company on it would mean the default changed. If the next cross-vendor finding arrives as a conference talk with no vendor coordination and no framework text behind it, the model was a statement two competitors made on a week when the facts flattered both.
